=== Byvano for WooCommerce ===
Contributors: seztech
Tags: shoppable video, video commerce, video widget, woocommerce video, social video
Requires at least: 5.8
Tested up to: 7.1
Stable tag: 2.5.1
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Shoppable video widgets for WooCommerce from your Reels, Shorts and TikToks, plus a social post scheduler. Needs a free Byvano account.

== Description ==

**Byvano** — by [Seztech](https://seztech.com) — puts your short social videos on your WooCommerce store as shoppable video widgets. Import videos, tag your products on them, and show them in a carousel, grid, stories row, inline player or floating bubble. Each tagged product appears on the video with a **Shop** link to its WooCommerce product page.

This plugin is the WordPress client for the Byvano service (software as a service). **A Byvano account is required**; the free plan is enough to try everything below. Your videos, tags, widgets and scheduled posts are stored in your Byvano account, not in WordPress.

= Shoppable video =

* **Import** — Connect Instagram, YouTube or TikTok and pick exactly which videos to import, or upload MP4 / WebM files directly.
* **Manage videos** — Preview, rename and delete videos without leaving WordPress.
* **Tag products** — Search your WooCommerce catalogue by title or SKU and tag products on a video. The Products tab shows how many videos each product appears in.
* **Widgets** — Create and edit widgets: name, type, placement, which videos and in what order, active on/off.
* **Placement** — Homepage, product pages, shop and category archives, or anywhere with a shortcode.
* **Analytics (opt-in)** — Views, plays and product-link clicks per day, top videos and a comparison with the previous period. Off until you enable it.

= Social scheduler =

* **Compose** — Write a post, attach an image or video, pick the connected accounts and publish now, schedule it, or save a draft. A character counter shows each network's limit, and an optional AI helper drafts a caption.
* **Posts and calendar** — List, filter, edit, reschedule, publish or delete posts, and see them on a month calendar in your workspace timezone.
* **Media library** — Upload, browse and delete the images and videos used in posts.
* **Publishing accounts** — Connect and disconnect accounts and choose default destinations. Which networks are available depends on your Byvano account.
* **Results** — Publishing totals and a per-post results table.

= Also included =

* **Billing and plan** — See your plan, usage and limits. Plans are changed and paid for on byvano.com.
* **Diagnostics** — API test, system report and an activity log that never records your API key.

= How it works =

1. Create a free account at [byvano.com](https://byvano.com) and generate an API key.
2. Install this plugin, open **Byvano** in the admin menu and paste the key.
3. Import or upload videos and tag your products.
4. Create a widget and choose where it appears.

= Shortcode =

Place a widget anywhere with: `[byvano_video widget="YOUR_WIDGET_ID" layout="carousel"]`

`layout` is optional: `carousel`, `grid`, `stories`, `floating` or `inline`.

== External services ==

This plugin relies on the Byvano service and, for playback of videos hosted elsewhere, on the video platforms themselves. Nothing is sent anywhere until you save a Byvano API key. This section lists every outbound connection.

= 1. Byvano API, from your WordPress server (byvano.com) =

Service: Byvano, operated by Seztech Inc. — the service that stores and serves your videos, product tags, widgets, scheduled posts and media.

When: only when an administrator uses the Byvano screens in wp-admin (connecting, loading a tab, saving, uploading, scheduling). There are no background or scheduled requests.

What is sent:

* Your Byvano API key (as a request header) and your site URL (in the User-Agent header) with every request.
* When you tag a product on a video: that product's ID, title, price, image URL and product page URL.
* When the Products tab is opened: the IDs of the products on the page being viewed, to look up how many videos they are tagged in.
* When you upload a video or a media-library file: the file itself and its file name.
* When you create or edit widgets: the widget name, type, placement and the selected videos.
* When you use the scheduler: the post text, the chosen accounts, the schedule time, attached media, and, if you use the AI caption helper, the brief you type and the attached media reference.
* When you change them: workspace settings such as the timezone.

The API address is fixed to `https://byvano.com`. The "Custom endpoint" setting only accepts an `https://` address on byvano.com unless a developer defines `BYVANO_DEV_API_BASE` in `wp-config.php`.

= 2. Byvano, from your visitors' browsers (byvano.com) =

When: only on pages where a Byvano widget is displayed (a placement you configured, or a page containing the shortcode). Pages without a widget make no request.

What is sent:

* A request for the widget's configuration and video list (`/api/widgets/{widget id}`, plus the current product ID on product pages).
* Requests for video files and thumbnails served by Byvano (`/uploads/...` and `/api/media`).
* **Only if you enable "Storefront analytics"** (off by default on new installs): view, play and product-link click events (`/api/analytics`) containing the widget ID, video ID, event type and product ID.

As with any web request, Byvano's servers receive the visitor's IP address, browser user agent and the address of the referring page. When analytics is enabled, these are stored with each event. No cookies are set by the widget.

Byvano Terms of Service: https://byvano.com/terms
Byvano Privacy Policy: https://byvano.com/privacy

= 3. YouTube (Google) =

Videos imported from YouTube are played with the standard YouTube embedded player (`www.youtube.com/embed/...`) when a visitor opens one, and in the video preview in wp-admin. Their thumbnails are loaded from `img.youtube.com` in wp-admin. The browser connects to Google, which receives their IP address, user agent and referrer and may set cookies.

Google Terms of Service: https://policies.google.com/terms
YouTube Terms of Service: https://www.youtube.com/t/terms
Google Privacy Policy: https://policies.google.com/privacy

= 4. Instagram (Meta) =

Videos imported from Instagram are served through Byvano where possible; where an embedded player is needed (and in the wp-admin video preview) the Instagram embed (`www.instagram.com/.../embed`) is loaded in the browser, which then connects to Meta. Meta receives the IP address, user agent and referrer and may set cookies.

Meta Terms of Service: https://www.facebook.com/terms.php
Instagram Terms of Use: https://help.instagram.com/581066165581870
Meta Privacy Policy: https://www.facebook.com/privacy/policy/

= 5. TikTok =

If a video imported from TikTok has no playable file on Byvano, the TikTok embedded player (`www.tiktok.com`) is loaded in the visitor's browser when they open that video. TikTok receives the IP address, user agent and referrer and may set cookies.

TikTok Terms of Service: https://www.tiktok.com/legal/terms-of-service
TikTok Privacy Policy: https://www.tiktok.com/legal/privacy-policy

= 6. Sign-in pop-ups for connecting social accounts =

When — and only when — an administrator clicks **Connect** for a network in wp-admin, a pop-up window opens the sign-in address returned by Byvano. That window loads byvano.com and then the network's own authorisation page: Google (YouTube), Meta (Facebook, Instagram), TikTok or LinkedIn. You sign in on their site; this plugin never sees your password or the access token, which is held by Byvano.

Google: https://policies.google.com/terms — https://policies.google.com/privacy
Meta: https://www.facebook.com/terms.php — https://www.facebook.com/privacy/policy/
TikTok: https://www.tiktok.com/legal/terms-of-service — https://www.tiktok.com/legal/privacy-policy
LinkedIn: https://www.linkedin.com/legal/user-agreement — https://www.linkedin.com/legal/privacy-policy

= 7. Thumbnails and profile pictures in wp-admin =

On the Byvano screens in wp-admin, thumbnails of imported videos and of published posts, and the profile pictures of your connected social accounts, may be loaded by your browser directly from the content servers of the network they belong to (Google / YouTube, Meta, TikTok, LinkedIn). Only administrators viewing those screens are affected; the policies linked above apply.

On the storefront, a widget shows each video's thumbnail. Thumbnails of Instagram videos and of uploaded videos are served by Byvano. The thumbnail of a video imported from YouTube or TikTok, and for some of those videos the video file itself, may be loaded by the visitor's browser directly from that network's content servers when the widget is displayed; that network then receives the visitor's IP address, user agent and referrer.

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/byvano-for-woocommerce/`, or install the plugin through the WordPress Plugins screen.
2. Activate the plugin through the 'Plugins' menu in WordPress.
3. Go to **Byvano** in your admin menu.
4. Paste an API key from your [Byvano dashboard](https://byvano.com/dashboard/settings?section=api).

== Frequently Asked Questions ==

= Do I need a Byvano account? =

Yes. The plugin is a client for the Byvano service and does nothing without an account. Sign up for free at [byvano.com](https://byvano.com). The free plan includes up to 5 videos and 1 connected social account.

= Where do I get my API key? =

Log in to your [Byvano dashboard](https://byvano.com/dashboard/settings?section=api), open Settings → API keys, and create a key.

= Does this work without WooCommerce? =

No. This plugin requires WooCommerce for product tagging, placements and storefront integration.

= Does the plugin track my visitors? =

Not unless you turn it on. Storefront analytics is off on new installs. If you enable it (Analytics tab or Settings → Storefront and privacy), the widget reports video views, plays and product-link clicks to byvano.com. See "External services" for exactly what is sent. Sites that were already connected before 2.5.0 keep analytics on, as before, and can switch it off in Settings.

= Does the plugin add any links or credits to my store? =

No. The plugin never adds a credit, "Powered by" text or a link to byvano.com on your storefront. The only links inside a video widget are the Shop links to your own WooCommerce product pages.

= How do shoppers buy from a video? =

Each tagged product appears on the video with a Shop link that opens its WooCommerce product page, where the shopper adds it to the cart as usual.

= Can I use different widgets on different pages? =

Yes. Assign widgets to the homepage, product pages and shop / category pages under Widgets → Widget placements, and use the `[byvano_video widget="ID"]` shortcode anywhere else.

= The scheduler says "Reconnect your Byvano account" =

API keys created before the scheduler existed do not carry the permissions it needs. Create a new key in your Byvano dashboard and paste it into Settings → API connection.

= I installed Byvano from a ZIP file before. What should I do? =

Earlier ZIP downloads from byvano.com used the folder `byvano-video-commerce`. Deactivate that copy, activate this plugin, then delete the old copy. Deleting the old copy clears the saved settings, so paste your API key again afterwards. Your videos, tags, widgets and posts live in your Byvano account and are not affected.

= Where is my data stored? =

In your Byvano account. WordPress stores only the plugin's settings, the API key and a short activity log. You can export or delete your Byvano data from Settings → Your data, which links to byvano.com.

== Screenshots ==

1. Home: setup progress, shoppable video and scheduler figures at a glance
2. Widgets and widget placements
3. A shoppable video carousel on the storefront
4. Settings with the Byvano account and API key connection
5. Scheduler: compose a post, with the AI caption helper

== Changelog ==

= 2.5.1 =
* Removed: The optional "Powered by Byvano" link under storefront widgets and its setting. The storefront widget no longer prints any credit or link to byvano.com; the only links are your own product pages.

= 2.5.0 =
* Simplified admin interface; all social networks on one Connect page.
* Privacy: Storefront visitor analytics is now opt-in. New installs send no analytics until you enable it on the Analytics tab or in Settings. Sites already connected before this version keep it on and can switch it off.
* Privacy: The "Powered by Byvano" link under widgets is now opt-in and off by default on every site, including upgrades.
* Privacy: The readme now documents every external connection, and suggested text is added to the WordPress privacy policy guide.
* Security: The storefront script builds all markup with safe DOM methods and checks every link and media address before using it.
* Security: The saved API key is never printed into the admin page — only a masked form is shown, and a key is sent only when you type a new one. The key and account details are no longer autoloaded on every page view.
* Security: The custom API address must be an https address on byvano.com (developers can override with `BYVANO_DEV_API_BASE` in wp-config.php), so the key cannot be sent to another host.
* Fixed: Uploading a video always ended with an error even though the video was stored. The video is no longer created twice.
* Fixed: Large uploads are streamed from disk instead of being read into PHP memory.
* Fixed: "Shop / category" and "Custom embed" widgets were silently saved as "Homepage". A new widget now fills its storefront slot when that slot is empty; Custom embed widgets are shortcode-only.
* Fixed: Analytics charts were empty. Views over time, top videos and a previous-period comparison now show real data.
* Fixed: Widgets with more than three videos showed "3+" — the real count is shown.
* Fixed: The API key placeholder showed a prefix that real keys do not use.
* Removed: Add-to-cart figures from Analytics. The widget links to the product page and never reported them.
* Added: Rename and delete videos.
* Added: Edit widgets — name, type, placement, videos, playback order and active on/off.
* Added: Products tab — your WooCommerce catalogue with the number of videos each product is tagged in.
* Added: Scheduler tab — compose, schedule and publish social posts, a calendar, media library, publishing accounts, results and workspace timezone.
* Added: Settings → Your data, with a link to export or delete your data on byvano.com.
* Updated: Tested up to WordPress 7.1 and WooCommerce 11.2.

= 2.4.0 =
* Fixed: Connecting a social account left the plugin showing "not connected" — the sign-in pop-up said connected but closing it changed nothing. The plugin now watches for the account landing, closes the pop-up itself and refreshes straight away.
* Fixed: Product tagging showed no products until you typed a search. The WooCommerce catalogue now loads as soon as the tab opens, with By title / By SKU search and Load more.
* Fixed: Uploaded videos and thumbnails never loaded in the admin or on the storefront. Byvano returns media as a site-relative path, which resolved against the shop's own domain instead of byvano.com.
* Fixed: Videos with no thumbnail now show the video's own first frame instead of a blank placeholder.
* Fixed: Direct upload is now a two-step dialog with a real progress bar, a working Cancel that aborts the transfer, and a plan-limit notice shown before you pick a file rather than after the upload finishes.
* Fixed: The import menu now disables platforms that are not connected, instead of opening an empty picker.
* Added: Overview rebuilt to match the Byvano dashboard — connected accounts, total videos, products tagged and active widgets, a plan-limit banner, and a quick-start grid with progress.
* Added: Videos tab matches the dashboard — per-platform counts, draft/published badges, and a detail dialog that really plays YouTube, Instagram and uploaded videos.
* Added: Widgets tab matches the dashboard — widget type cards with descriptions, all four placements, expandable details with a video strip, Copy ID and Copy shortcode, and an in-plugin delete confirmation.
* Added: Billing tab now shows the full plan line-up with the current plan highlighted and Stripe upgrade links, alongside subscription status and usage limits.
* Added: Analytics tab matches the dashboard — views over time, conversion funnel and top videos, with the same empty states rather than invented numbers.
* Changed: Confirmation dialogs for disconnecting an account and deleting a widget are now in-plugin, so they match the rest of the interface.

= 2.3.0 =
* Fixed: Direct video upload always failed with "Invalid upload" — the file was checked with is_uploaded_file() after WordPress had already moved it, so the check could never pass
* Fixed: Analytics showed 0 tag clicks, 0 add-to-cart and 0% click rate because the admin screen read field names the API does not return
* Fixed: The "Views over time" chart drew random bars when no data was available; it is now a real engagement breakdown built from actual event counts
* Fixed: TikTok could not be connected on the Connect tab even though import and the API already supported it
* Fixed: Product prices were formatted as US dollars regardless of the store currency
* Fixed: Deleting a widget left it selected as a placement, so the storefront kept requesting a widget that no longer existed
* Fixed: A saved widget placement was never preselected in the Widgets tab — the dropdown always read "None", so pressing Save placements silently cleared the placement
* Security: The API key is no longer printed into the admin page or placed in a browser URL — social sign-in links are now created server side
* Added: Settings tab with environment, API URL, cache lifetime, debug mode, disconnect and reset
* Added: Diagnostics tab with an API connectivity test, latency, system report and an activity log that never records secrets
* Added: Help tab with documentation, FAQ, support, shortcode reference and troubleshooting
* Added: Account panel showing your Byvano profile, plan, masked API key and last sync time
* Added: Floating and inline widget layouts, matching the Byvano web dashboard
* Added: Response caching with a Clear cache action, so switching tabs no longer re-fetches everything
* Added: The plugin is now fully translation ready, including the admin JavaScript strings
* Added: uninstall.php that cleans options and cached data on every site of a multisite network
* Updated: Bundled storefront script refreshed — adds view, play and tag-click tracking, floating and inline layouts, and a scrollable product list in the video modal
* Updated: Tested up to WordPress 7.0 and WooCommerce 10.9

= 2.2.0 =
* Added: Choose which social videos to import — a picker with thumbnails, titles, publish dates, search, sort, and select-all instead of auto-importing the latest videos
* Added: Plan-limit aware selection — you can only select up to your plan's remaining video slots, enforced on the server too
* Added: TikTok added to Import from… and video filters

= 2.1.0 =
* Added: Billing & Plan page showing current plan, subscription status, renewal/expiry date, current limits, plan features, and connected sites
* Added: Live plan sync — the plan shown in the header and Billing page reflects your current Byvano plan
* Updated: Support contact email is now contact@byvano.com
* Updated: Free plan documented correctly as 5 videos / 1 social account

= 2.0.0 =
* Added: capability checks on all AJAX handlers
* Added: register_uninstall_hook for proper cleanup on uninstall
* Fixed: esc_url() applied on admin_url() output
* Fixed: Tested up to version corrected to 6.7
* Updated: Author changed to Seztech
* Updated: External Services disclosure added to readme

= 1.0.0 =
* Initial release
* API key connection to Byvano platform

== Upgrade Notice ==

= 2.5.1 =
The storefront widget no longer has a "Powered by Byvano" link or setting; nothing else changes.

= 2.5.0 =
Privacy and security release: storefront analytics and the Byvano credit link are now opt-in (the credit link is switched off on upgrade). Fixes video upload and adds video and widget editing plus the social scheduler.

= 2.4.0 =
Social sign-in now completes properly, product tagging lists your catalogue straight away, uploaded videos and thumbnails load again, and every screen matches the Byvano dashboard. Recommended for everyone.

= 2.3.0 =
Fixes direct video upload (previously always failed) and the analytics numbers, stops the API key appearing in the page, and adds Settings, Diagnostics and Help tabs. Recommended for everyone.

= 2.2.0 =
Import just the videos you want: a new picker lets you select specific YouTube, Instagram, and TikTok videos, with search, sort, and plan-limit awareness.

= 2.1.0 =
New Billing & Plan page: view your current plan, subscription status, renewal date, and usage limits directly in WordPress.

= 2.0.0 =
Security update: added capability checks on all admin AJAX endpoints. Upgrade recommended.
